OSEP Tester PEN-300 Course Review

Overview

Offensive Security has released several new courses recently, including Evasion Techniques and Breaching Defenses (PEN-300), which primarily focuses on “penetration tests against mature organizations with an established security function.” After reading that overview on the website, I was excited to take on the challenge and expand my knowledge base in preparation for obtaining the OSEP certification.

PEN-300 students are given videos and a massive, 700+ page PDF of training material. The course also features individual lab modules for each chapter, as well as six lab challenges. While a big portion of the content does spotlight evading Anti-Virus (AV) and/or Endpoint Detection and Response (EDR) tools, the training is less focused on evading an active Blue Team. The challenge labs and exam offer several paths to exploitation—for example, a lab may contain an initial access point through web vulnerability but also provide an e-mail address to target for a phishing attempt through a malicious Word document or link. Given this, the environment provides plenty of opportunity to learn cutting edge techniques and apply them in a lab environment.

After exploiting all six lab challenges and passing the exam, I can say that this course will challenge a seasoned penetration tester that is already comfortable with Windows environments. I would recommend the Offensive Security Certified Professional (OSCP) certification as a prerequisite, though it is not required. I also highly recommend PEN-300 itself, as I believe that my attack arsenal has grown as a penetration tester now that I have completed the materials.

Tips & Tricks

When I began the PEN-300 course, I started by watching the videos and following along through the provided PDF—the entire program took about two weeks using my process. Now having gone through it, I suggest to others interested in the course that you write your own code as you go along instead of trying to copy and paste—this will help in fully understanding the concepts. Then, when you have code that works, save it, and include an inline comment containing the shellcode command, which will make life easier should you run into a scenario where you need that code. Each section also includes “Extra Mile” activities, and I would recommend completing those before moving on to the labs, as they are designed to re-enforce the concepts presented.

When it comes to the lab challenges, they are meant to test specific techniques taught through the course, and each of the six contains a small environment of isolated servers. There is often more than one path to compromise all boxes within the environment, so you will be forced to think critically on how to move laterally and eventually escalate privileges—again, as you write code that compiles and works, save it. Don’t be afraid to repeat anything that may have taken a longer time to solve for added clarity and confidence, and before you attempt the exam, double check that your code works as expected.

Helpful Tools

There are also several tools available that can help with PEN-300 and only require a foundational understanding. Though knowledge of these tools is not required, I can attest that I did find them useful—here are a few that helped me move through the course while building on the training provided:

Closing Thoughts

In my experience, the PEN-300 course is perfect for anyone looking to expand their internal network penetration testing knowledge, as it teaches techniques for escalation and lateral movement on the Linux and Windows side. Previous knowledge of basic Active Directory, C#, and debugging will help immensely. This course will bring you deep into the weeds to make sure you understand what you are doing and how to leverage it to complete your objective and own the environment.